Binary authenticity and code signing

Speedwave verifies release artifacts through two distinct cryptographic verification layers: OS-level code signing for fresh installations and internal cryptographic verification for automated updates. See Security architecture for broader context.

OS-level code signing and notarization

On macOS, all binary executables bundled within Speedwave.app (including embedded Lima virtualization tools, Node.js runtimes, Swift helper shims, and the Rust CLI) are signed using Speednet’s official Apple Developer ID Application certificate. Executables enable Apple’s Hardened Runtime and include secure Apple timestamps. Packaged releases are submitted to Apple Notary Service, with stapled notarization tickets enabling Gatekeeper validation offline.

This mechanism enforces three security guarantees:

Modifying binary packages in transit invalidates macOS Gatekeeper signatures.
Only artifacts compiled with Speednet’s cryptographic private keys pass initialization checks.
Hardened Runtime protections prevent dynamic code injection into active processes.

Cryptographic update verification

For existing installations, Speedwave’s internal updater validates downloaded release archives against an Ed25519 public key embedded directly within the application binary. The corresponding private key resides strictly within isolated CI environments and is never stored on developer workstations. Even if release distribution mirrors were compromised, the updater rejects any package lacking a valid signature from the authorized CI key.

Defense-in-depth signing model

First-time installations are protected by OS-level code signing. Automated updates pass through both layers: internal Ed25519 signature verification during download, followed by Gatekeeper binary validation upon process restart. This dual-layer architecture ensures release integrity across the entire software distribution lifecycle.

For update reconciliation details, consult Updates and recovery architecture.